What happened
Cloudflare is hosting PACT — Private Access Control Tokens — an open protocol for authenticating AI agents and automated bots before they interact with a site. The backer list is the actual news: Google Chrome, Microsoft Edge, and Mozilla Firefox on the browser side, plus Shopify from ecommerce.
The mechanics: sites with strong signals about personhood issue anonymous tokens, and a user's browser presents those tokens to other sites to prove a human is behind the visit — or behind the agent acting on their behalf. The goal is separating authorized agents from abusive bots without leaning on CAPTCHAs or browser fingerprinting. It's positioned as a permission and authentication layer for agentic web access, sitting alongside the ARD and WebMCP specs.
Shopify's Ilya Grigorik framed the merchant tension directly: stores need real protection from automated abuse, but buyers shouldn't pay for it "with unnecessary friction," as he put it. No launch date was announced, and the biggest question went unanswered — who actually gets to issue the trust tokens that decide personhood.
Why this matters
When Google and Shopify back the same spec, opting out later gets expensive. Agent traffic — comparison assistants, shopping agents, eventually checkout agents — is going to negotiate access through some layer, and this roster says PACT is the leading candidate. Shopify wiring it toward platform infrastructure is the tell: agent gating is becoming a platform feature, not a bolt-on.
For BigCommerce merchants, expect equivalent controls to arrive, and expect them to surface first as Cloudflare settings, since so many stores already sit behind that network. The practical risk is inheritance: an over-strict default silently turns away legitimate shopping agents carrying real buyers, while an over-loose one waves scrapers through. Neither failure announces itself.
Keep some skepticism handy too. Anonymous personhood tokens sound privacy-friendly, but issuance concentrates power — whoever mints the tokens becomes the web's bouncer, and the announcement leaves that seat conspicuously empty. A protocol positioned around Cloudflare's network also ties your access policy to one vendor's rails. None of that is a reason to ignore PACT; all of it is a reason to adopt it deliberately, with the trade-offs on the table instead of buried in a settings panel.
What to do about it
Document your current bot posture
Pull up your Cloudflare or WAF bot settings today and write down what's actually on: bot-fight modes, AI-crawler blocks, challenge rules. When PACT-era controls land, you want a deliberate baseline to compare against — not amnesia about which toggles you inherited.
Treat new agent toggles as policy decisions
When agent-gating options appear in your CDN dashboard or platform admin, don't accept the default. Decide which agent categories you want browsing, quoting, and eventually transacting on your store. An agent you block is an agent that can't buy.
Put the question to BigCommerce
Shopify has publicly declared its position; this announcement says nothing about your platform. Ask your BigCommerce rep or dev partner what the roadmap is for agent authentication and which specs — PACT, WebMCP, ARD — they intend to support. The answer shapes your next re-platform-or-stay conversation.
Log what agent traffic you get today
You can't judge a gating standard's impact on a store that's never measured its agent visits. Start tagging and reviewing likely agent traffic in your analytics and server logs now, so when a permission layer arrives you know what you'd be admitting or refusing.